Windows Update Baseline joins the Security Compliance Toolkit

Published Jan 26 2021 09:07 AM 12K Views
Microsoft

 

We are excited to announce the Update Baseline is now a part of the Security Compliance Toolkit! The Update Baseline is a new security baseline to ensure devices on your network get the latest Windows security updates on time while also providing a great end user experience through the update process.  

 

The Update Baseline covers Windows Update policies as well as some additional Power and Delivery Optimization policies to improve the update process and ensure devices stay secure. 

 

Why do I need the Update Baseline? 

 

We recommend using the Update Baseline to improve your patch compliance and keep devices on your network up to date and secure. The Update Baseline is Microsoft’s set of recommended policy configurations for Windows Updates to ensure devices on your network receive the monthly security update in a timely manner. Devices that are configured for the Update Baseline reach on average a compliance rate between 80-90% within 28 days. 

 

What is included in the Update Baseline? 

 

For Windows Update policies, the Update Baseline ensures: 

  • Setting deadlinesDeadlines are the most powerful tool in the IT administrator’s arsenal for ensuring devices get updated on time. 
  • Downloading and installing updates in the background without disturbing end users. This also removes bottlenecks from the update process. 
  • A great end user experience. Users don’t have to approve updates, but they get notified when an update requires a restart. 
  • Accommodating low activity devices (which tend to be some of the hardest to update) to ensure the best-possible user experience while respecting compliance goals. 

 

Rick_Munck_0-1611680508476.png

 

 

Learn more about common policy configuration mistakes for managing Windows updates and what you can do to avoid them to improve update adoption and provide a great user experience. 

 

How do I apply the Update Baseline? 

If you manage your devices via Group Policy, you can apply the Update Baseline using the familiar Security Compliance Toolkit framework. With a single PowerShell command, the Update Baseline Group Policy Object (GPO) can be loaded into Group Policy Management Center (GPMC).  

Rick_Munck_1-1611680508492.png

 

 

The MSFT Windows Update GPO that implements the Update Baseline is added to GPMC with a single command. 

Rick_Munck_2-1611680508486.png

 

 

You will then be able to view the Update Baseline GPO (MSFT Windows Update) in GPMC. 

 

That’s it! It’s that simple. 

 

Other cool tidbitsThe Update Baseline will continue to be updated and improved as needed, and a Microsoft Endpoint Manager solution to apply the Update Baseline is coming soon! Let us know your thoughts and leave a comment below. 

14 Comments
%3CLINGO-SUB%20id%3D%22lingo-sub-2098482%22%20slang%3D%22en-US%22%3EWindows%20Update%20Baseline%20joins%20the%20Security%20Compliance%20Toolkit%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2098482%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EWe%20are%20excited%20to%20announce%20the%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fdeployment%2Fupdate%2Fupdate-baseline%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EUpdate%20Baseline%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bis%20now%20a%20part%20of%20the%20Security%20Compliance%20Toolkit!%20The%20Update%20Baseline%20is%20a%20new%20security%20baseline%20to%20ensure%20devices%20on%20your%20network%20get%20the%20latest%20Windows%20security%20updates%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eon%20time%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bwhile%20also%20providing%20a%20great%20end%20user%20experience%20through%20the%20update%20process.%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EThe%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EUpdate%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3BBaseline%20covers%20Windows%20Update%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Epolicies%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eas%20well%20as%20some%20additional%20Power%20and%20Delivery%20Optimization%20policies%20to%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eimprove%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bthe%20update%20process%20and%20ensure%20devices%20stay%20secure.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20aria-level%3D%222%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EWhy%20do%20I%20need%20the%20Update%20Baseline%3F%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EWe%20recommend%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eusing%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bthe%20Update%20Baseline%20to%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eimprove%20your%20patch%20compliance%20and%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ekeep%20devices%20on%20your%20network%20up%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eto%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Edate%20and%20secure.%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3BThe%20Update%20Baseline%20is%20Microsoft%E2%80%99s%20set%20of%20recommended%20policy%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Econfigurations%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Efor%20Windows%20Updates%20to%20ensure%20devices%20on%20your%20network%20receive%20the%20monthly%20security%20update%20in%20a%20timely%20manner.%20Devices%20that%20are%20configured%20for%20the%20Update%20Baseline%20reach%20on%20average%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ea%20compliance%20rate%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ebetween%2080-90%25%20within%2028%20days.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20aria-level%3D%222%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EWhat%20is%20included%20in%20the%20Update%20Baseline%3F%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EFor%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3BWindows%20Update%20policies%2C%20the%20Update%20Baseline%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bensures%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%3A%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%20data-leveltext%3D%22%EF%82%B7%22%20data-font%3D%22Symbol%22%20data-listid%3D%221%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%221%22%20data-aria-level%3D%221%22%3E%3CSPAN%20data-contrast%3D%22none%22%3ESetting%20deadlines%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E.%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fdeployment%2Fupdate%2Fwufb-compliancedeadlines%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EDeadlines%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bare%20the%20most%20powerful%20tool%20in%20the%20IT%20administrator%E2%80%99s%20arsenal%20for%20ensuring%20devices%20get%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eupdated%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eon%20time%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233279%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%20data-leveltext%3D%22%EF%82%B7%22%20data-font%3D%22Symbol%22%20data-listid%3D%221%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%222%22%20data-aria-level%3D%221%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EDownloading%20and%20installing%20u%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Epdates%20in%20the%20background%20without%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Edisturbing%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bend%20users.%20This%20also%20removes%20bottlenecks%20from%20the%20update%20process.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233279%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%20data-leveltext%3D%22%EF%82%B7%22%20data-font%3D%22Symbol%22%20data-listid%3D%221%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%223%22%20data-aria-level%3D%221%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EA%20great%20end%20user%20experience.%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EUsers%20don%E2%80%99t%20have%20to%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bapprove%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eupdates%2C%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bbut%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ethey%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eget%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bnotified%20when%20a%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3En%20update%20requires%20a%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Erestart.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233279%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%20data-leveltext%3D%22%EF%82%B7%22%20data-font%3D%22Symbol%22%20data-listid%3D%221%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%224%22%20data-aria-level%3D%221%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EAccommodating%20low%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bactivity%20devices%20(which%20tend%20to%20be%20some%20of%20the%20hardest%20to%20update)%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eto%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eensure%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ethe%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ebest-possible%20user%20experience%20while%20respecting%20compliance%20goals.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233279%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Rick_Munck_0-1611680508476.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F249565i43210048507C1005%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22Rick_Munck_0-1611680508476.png%22%20alt%3D%22Rick_Munck_0-1611680508476.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EL%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eearn%20more%20about%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fwindows-it-pro-blog%2Fcommon-policy-configuration-mistakes-for-managing-windows%2Fba-p%2F2077328%22%20target%3D%22_blank%22%3E%3CSPAN%20data-contrast%3D%22none%22%3Ecommon%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Epolicy%20configuration%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Emistakes%20for%20managing%20Windows%20updates%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eand%20what%20you%20can%20do%20to%20avoid%20them%20to%20improve%20update%20adoption%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Band%20provide%20a%20great%20user%20experience%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20aria-level%3D%222%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EHow%20do%20I%20apply%20the%20Update%20Baseline%3F%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EIf%20you%20manage%20your%20devices%20via%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3EGroup%20Policy%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3E%2C%20you%20can%20apply%20the%20Update%20Baseline%20using%20the%20familiar%20Security%20Compliance%20Toolkit%20framework.%20With%20a%20single%20PowerShell%20command%2C%20the%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3EUpdate%20Baseline%20Group%20Policy%20Object%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B(GPO)%20can%20be%20loaded%20into%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3EGroup%20Policy%20Management%20Center%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B(GPMC).%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Rick_Munck_1-1611680508492.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F249567i98594C2103714A70%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22Rick_Munck_1-1611680508492.png%22%20alt%3D%22Rick_Munck_1-1611680508492.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CI%3E%3CSPAN%20data-contrast%3D%22none%22%3EThe%20MSFT%20Windows%20Update%20GPO%20that%20implements%20the%20Update%20Baseline%20is%20added%20to%20GPMC%20with%20a%20single%20command.%3C%2FSPAN%3E%3C%2FI%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Rick_Munck_2-1611680508486.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F249566i5B366EF3BEE8F270%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22Rick_Munck_2-1611680508486.png%22%20alt%3D%22Rick_Munck_2-1611680508486.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CI%3E%3CSPAN%20data-contrast%3D%22none%22%3EYou%20will%20then%20be%20able%20to%20view%20the%20Update%20Baseline%20GPO%20(MSFT%20Windows%20Update)%20in%20GPMC.%3C%2FSPAN%3E%3C%2FI%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EThat%E2%80%99s%20it!%20It%E2%80%99s%20that%20simple.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EOther%20cool%20tidbits%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%3F%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EThe%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EUpdate%20Baseline%20will%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Econtinue%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bto%20be%20updated%20and%20improved%20as%20needed%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%2C%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Band%20a%20Microsoft%20Endpoint%20Manager%20solution%20to%20apply%20the%20Update%20Baseline%20is%20coming%20soon!%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3BLet%20us%20know%20your%20thoughts%20and%20leave%20a%20comment%20below.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-2098482%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22WUBaseline.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F249563i9EF425A437FB0CDA%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22WUBaseline.png%22%20alt%3D%22WUBaseline.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EWindows%20Update%20is%20joining%20the%20Security%20Compliance%20Toolkit%20providing%20a%20centralized%20location%20for%20their%20baseline.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2102607%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Update%20Baseline%20joins%20the%20Security%20Compliance%20Toolkit%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2102607%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F272514%22%20target%3D%22_blank%22%3E%40Rick_Munck%3C%2FA%3E%26nbsp%3BWouldn't%20the%20'%3CSPAN%3EAllow%20standby%20states%20(S1-S3)%20when%20sleeping%20(on%20battery)'%20and%20'Allow%20standby%20states%20(S1-S3)%20when%20sleeping%20(plugged%20in)'%20directly%20conflict%20with%20the%20intended%20values%20from%20the%20BitLocker%20baseline%20policy%20%3CEM%3E(referencing%20the%20latest%20'MSFT%20Windows%2010%2020H2%20-%20BitLocker'%2C%20but%20they%20have%20been%20recommended%20that%20way%20for%20many%20baselines%20now)%3C%2FEM%3E%3F%20Perhaps%20the%20intention%20is%20that%20if%20one%20is%20using%20BitLocker%2C%20we%20favor%20those%20settings%2C%20but%20if%20the%20Update%20Baseline%20is%20intended%20to%20be%20used%20in%20tandem%20with%20the%20other%20baselines%2C%20it%20just%20seems%20a%20little%20bit%20odd%20that%20we%20would%20have%20conflicting%20settings.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EIn%20addition%2C%20aren't%20a%20number%20of%20the%20configured%20settings%20functionally%20enforcing%20defaults%3F%20I%20am%20assuming%20that%20is%20probably%20fully%20intentional%2C%20as%20perhaps%20the%20team%20believes%20these%20are%20settings%20that%20would%20be%20misconfigured%20by%20an%20unaware%20admin%2C%20but%20as%20there%20has%20been%20a%20push%20in%20the%20recent%20past%20to%20reduce%20the%20number%20of%20unnecessarily%20configured%20settings%20%3CEM%3E(meaning%20we%20are%20enforcing%20the%20same%20state%20as%20'Not%20Configured')%3C%2FEM%3E%2C%20I%20just%20wanted%20to%20double%20check.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2103383%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Update%20Baseline%20joins%20the%20Security%20Compliance%20Toolkit%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2103383%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F188992%22%20target%3D%22_blank%22%3E%40Alex%20Entringer%3C%2FA%3E%26nbsp%3BGreat%20callouts!%20Both%20of%20your%20statements%20are%20correct.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%20for%20your%20feedback.%20The%20Update%20Baseline%20is%20meant%20for%20admins%20really%20focused%20specifically%20on%20update%20velocity%20and%20calling%20the%20potential%20of%20policies%20for%20that%20goal.%20We%20know%20not%20everyone%20uses%20the%20BitLocker%20GPO%20just%20like%20not%20everyone%20uses%20the%20Update%20Baseline%20so%20like%20you%20said%20it's%20based%20on%20the%20needs%20of%20each%20unique%20organization.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYes%2C%20we%20absolutely%20recommend%20that%20default%20is%20best%20(i.e.%20leaving%20policies%20as%20'Not%20Configured'%20or%20enforcing%20the%20same%20state%20as%20'Not%20Configured').%20The%20purpose%20of%20the%20Update%20Baseline%20was%20to%20help%20admins%20clean%20up%20their%20misconfigured%20policies%20and%20get%20to%20a%20known%20good%20state.%20Hence%20the%20policy%20configurations%20mirror%20the%20default%20experience%20of%20when%20the%20policies%20are%20left%20as%20'Not%20Configured.'%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2108477%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Update%20Baseline%20joins%20the%20Security%20Compliance%20Toolkit%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2108477%22%20slang%3D%22en-US%22%3E%3CP%3ERegarding%20the%20Endpoint%20Manager%20solution.%3C%2FP%3E%3CUL%3E%3CLI%3EWill%20it%20be%20a%20GPO%20managed%20solution%20or%20a%20Endpoint%20manager%20baseline%3F%3C%2FLI%3E%3CLI%3ECan%20you%20share%20your%20thoughts%20how%20to%20control%20the%20baseline%20if%20a%20company%20has%20decided%20only%20to%20deploy%20a%20subset%20of%20available%20updates.%3CUL%3E%3CLI%3Ee.g.%20only%20security%20updates%3C%2FLI%3E%3C%2FUL%3E%3C%2FLI%3E%3C%2FUL%3E%3CP%3ELooking%20forward%20to%20see%20the%20final%20work%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2108724%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Update%20Baseline%20joins%20the%20Security%20Compliance%20Toolkit%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2108724%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F948011%22%20target%3D%22_blank%22%3E%40Rene_kierstein%3C%2FA%3E%2C%3C%2FP%3E%0A%3CP%3EThe%20current%20solution%20that%20is%20out%20is%20for%20GPO.%20We%20are%20working%20on%20an%20intune%20solution%20to%20come%20this%20year.%20%3A)%3C%2Fimg%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFor%20your%20second%20question--how%20can%20we%20adjust%20the%20baseline%20if%20a%20company%20only%20wants%20to%20deploy%20a%20subset%20of%20available%20updates%20(such%20as%20security%20updates)%3F%20The%20majority%20of%20policies%20that%20are%20configured%20in%20the%20Update%20Baseline%20are%20around%20user%20experience%20(e.g.%20notifications%2C%20access%20to%20features%2C%20etc)%20which%20is%20applicable%20to%20any%20type%20of%20update%20you%20are%20deploying%20to%20devices.%20To%20ensure%20your%20devices%20only%20get%20specific%20updates--for%20the%20sake%20of%20this%20example%20I%20will%20use%20security%20updates%20as%20the%20only%20type%20of%20update%20you%20are%20looking%20to%20deploy--I%20would%20check%20the%20following%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EMake%20sure%20all%20drivers%20and%20Microsoft%20product%20updates%20are%20turned%20off%3CUL%3E%0A%3CLI%3E%22Do%20not%20include%20drivers%20with%20Windows%20Updates%22%20-%20Set%20this%20to%20Enabled.%3C%2FLI%3E%0A%3CLI%3E%22Configure%20Automatic%20Updates%22%20-%20Make%20sure%20%22Install%20updates%20for%20other%20Microsoft%20products%22%20is%26nbsp%3B%3CU%3Enot%3C%2FU%3E%20selected.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FLI%3E%0A%3CLI%3EIf%20you%20are%20not%20deploying%20Feature%20Updates%20via%20Windows%20Update%2C%20is%20your%20device%20configured%20to%20connect%20to%20a%20WSUS%20server%3F%3CBR%20%2F%3E%3CUL%3E%0A%3CLI%3E%22Specify%20intranet%20Microsoft%20update%20service%20location.%22%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FLI%3E%0A%3CLI%3EI'd%20also%20double%20check%20Deadlines%2Foffering%20policies%20(such%20as%20deferrals%20and%20pause)%20which%20also%20affect%20when%20the%20Feature%20Update%20vs%20Quality%20Updates%20are%20offered.%3C%2FLI%3E%0A%3C%2FUL%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2110379%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Update%20Baseline%20joins%20the%20Security%20Compliance%20Toolkit%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2110379%22%20slang%3D%22en-US%22%3E%3CP%3EI'd%20recommend%20checking%20the%20%22Don't%20auto-restart%20until%20end%20of%20grace%20period%22%20under%3A%3C%2FP%3E%3CP%3EComputer%20Configuration%20%26gt%3B%20Policies%20%26gt%3B%20Administrative%20Templates%20%26gt%3B%20Windows%20Components%20%26gt%3B%20Windows%20Update%20%26gt%3B%20Specify%20deadline%20for%20automatic%20updates%20and%20restarts%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20reasoning%20is%2C%20the%20updates%20apply%20and%20the%20end%20user%20receives%20a%20notice%20their%20organization%20requires%20a%20restart%20in%20x%20days%20to%20apply%20the%20updates.%26nbsp%3B%20The%20user%20interprets%20this%20as%20they%20have%20x%20days%20before%20they'll%20need%20to%20restart.%26nbsp%3B%20Not%20so.%26nbsp%3B%20When%20the%20active%20hours%20expire%2C%20the%20PC%20reboots.%26nbsp%3B%20Users%20may%20lose%20data%20if%20they%20weren't%20expecting%20a%20reboot.%26nbsp%3B%20Or%2C%20change%20the%20notification%20to%20the%20PC%20will%20reboot%20anytime%20today%20after%20x%20(end%20of%20active%20hours)%20if%20the%20user%20is%20inactive%2Fidle.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2165377%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Update%20Baseline%20joins%20the%20Security%20Compliance%20Toolkit%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2165377%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F422310%22%20target%3D%22_blank%22%3E%40CaseyS%3C%2FA%3E%26nbsp%3BIn%20%22Specify%20deadline%20for%20automatic%20updates%20and%20restarts%22%20choose%20%22Don't%20auto-restart%20until%20end%20of%20grace%20period%22%20(under%20the%20%22Grace%20period%20(days)%22%20selection).%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2185028%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Update%20Baseline%20joins%20the%20Security%20Compliance%20Toolkit%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2185028%22%20slang%3D%22en-US%22%3E%3CP%3EWhat%20is%20the%20rationale%20behind%20enforcing%20the%20Power%20Management%20settings%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2203770%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Update%20Baseline%20joins%20the%20Security%20Compliance%20Toolkit%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2203770%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F986709%22%20target%3D%22_blank%22%3E%40Nasser_Alhamdan%3C%2FA%3E%26nbsp%3BThe%20reason%20we%20include%20power%20management%20settings%20is%20to%20widen%20the%20window%20of%20when%20your%20device%20can%20take%20an%20update.%20These%20small%20tweaks%20to%20the%20power%20settings%20gives%20additional%20flexibility%20of%20when%20end%20users%20take%20the%20update%20and%20can%20improve%20IT%20admins'%20overall%20adoption%20rates.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2207222%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Update%20Baseline%20joins%20the%20Security%20Compliance%20Toolkit%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2207222%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECan%20SCT%201.0%20Policy%20Analyzer%2C%20do%20more%20than%20SCCM%20compliance%20baseline%3F%20What%20scan%20for%20device%20and%20report%20back%20which%20is%20non%20compliance%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2214620%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Update%20Baseline%20joins%20the%20Security%20Compliance%20Toolkit%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2214620%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F594993%22%20target%3D%22_blank%22%3E%40Kay_Toma%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20testing%20the%20baseline%20for%20use%20in%20a%20higher-ed%20environment%20and%20I%20am%20trying%20to%20tweak%20the%20notifications%20to%20give%20faculty%20and%20researchers%20every%20opportunity%20to%20restart%20themselves%20before%20being%20forced.%26nbsp%3B%20However%20in%20testing%20the%20baseline%20via%20GPO%20on%20a%20Windows%2010%20Education%201909%20VM%20I%20am%20noticing%20that%20I%20am%20not%20getting%20any%20notifications%20indicating%20that%20a%20restart%20will%20happen%20other%20than%20the%20icon%20in%20the%20System%20Tray%20and%20the%20change%20to%20the%20Shutdown%2FRestart%20options%20from%20the%20Start%20Menu.%26nbsp%3B%20The%20baseline%20says%20that%20it%20is%20enforcing%20the%20defaults%20which%20I%20understand%26nbsp%3B%3CEM%3Eshould%26nbsp%3B%3C%2FEM%3E%20be%20to%20notify%20before%20restarting%2C%20but%20that%20doesn't%20seem%20to%20be%20the%20case.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-left%22%20image-alt%3D%22adv-wu.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F264453iB3EE942185573608%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22adv-wu.png%22%20alt%3D%22adv-wu.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3EI%20notice%20in%20the%20Advanced%20settings%20of%20the%20update%20panel%20that%20the%20option%20for%20Update%20notifications%20seems%20to%20be%20defaulted%20to%20Off%20(this%20was%20also%20the%20case%20after%20my%20clean%20install%2Fdomain%20join%2Fno%20policy).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20allowed%20access%20to%20the%20pause%20updates%20option%20to%20allow%20faculty%2Fresearchers%20to%20pause%20updates%20to%20allow%20for%20any%20computational%20runs%20to%20complete%20before%20restarting%2C%20but%20I%20can't%20seem%20to%20find%20the%20right%20combination%20of%20settings%20in%20the%20GPO%20to%20notify%20users%20properly.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20some%20recommended%20settings%20you%20can%20suggest%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2225382%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Update%20Baseline%20joins%20the%20Security%20Compliance%20Toolkit%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2225382%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F984386%22%20target%3D%22_blank%22%3E%40Russellang%3C%2FA%3E%20-%20if%20what%20you're%20asking%20is%20whether%20Policy%20Analyzer%20can%20be%20automated%20to%20serve%20as%20a%20compliance-verification%20tool%20non-interactively%2C%20at%20scale%2C%20etc.%2C%20no.%20It's%20designed%20to%20be%20an%20interactive%20tool%20only.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2274791%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Update%20Baseline%20joins%20the%20Security%20Compliance%20Toolkit%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2274791%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F226215%22%20target%3D%22_blank%22%3E%40John%20Siewert%3C%2FA%3E%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20actually%20just%20resolved%20a%20similar%20issue%20around%20the%20notifications.%20%3A)%3C%2Fimg%3E%20I%20encourage%20you%20to%20check%20out%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fwindows-servicing%2Fwufb-enabled-with-update-baseline-no-notifications%2Ftd-p%2F2259626%22%20target%3D%22_self%22%3Ethis%20thread%3C%2FA%3E.%20Basically%20what%20happened%20was%20after%20they%20had%20deployed%20the%20Update%20Baseline%2C%20they%20hadn't%20removed%20the%20reg%20keys%20of%20the%20Not%20Configured%20policies%20which%20was%20causing%20their%20notifications%20to%20be%20blocked.%20Once%20they%20removed%20those%20remaining%20reg%20keys%20they%20were%20able%20to%20get%20notifications%20as%20expected.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20strongly%20suggest%20getting%20to%20the%20known%20good%20state%20according%20to%20the%20Update%20Baseline%20first%20and%20see%20if%20those%20notifications%20fit%20your%20users%20needs.%20There%20are%20alternate%20ways%20to%20produce%20more%20notifications%2C%20but%20we%20don't%20recommend%20them%20as%20they%20can%20hurt%20your%20compliance%20rate%20by%20creating%20a%20bottleneck%20around%20end%20user%20interaction.%20For%20your%20case%2C%20I'd%20recommend%20allowing%20the%20download%20and%20install%20to%20happen%20automatically%20in%20the%20background%20and%20then%20to%20start%20showing%20notifications%20when%20it's%20time%20to%20restart%20(as%20the%20Update%20Baseline%20configures%20so).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ELet%20me%20know%20if%20you%20have%20any%20other%20questions%20or%20issues.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EBest%2C%3C%2FP%3E%0A%3CP%3EKay%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2276131%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Update%20Baseline%20joins%20the%20Security%20Compliance%20Toolkit%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2276131%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F594993%22%20target%3D%22_blank%22%3E%40Kay_Toma%3C%2FA%3E%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20VMs%20I%20have%20used%20for%20testing%20have%20been%20deployed%20via%20MDT%20using%20a%20custom%20gold%20image%20but%20I%20have%20the%20update%20steps%20in%20the%20Task%20Sequence%20disabled%20for%20these%20deployments.%26nbsp%3B%20I%20also%20don't%20domain%20join%20them%20during%20OSD%20so%20I%20can%20take%20a%20checkpoint%20of%20the%20fresh%20deployment%20and%20then%20join%20the%20domain%20into%20my%20test%20OU.%26nbsp%3B%20So%20these%20machines%26nbsp%3B%3CEM%3Eshould%20not%3C%2FEM%3E%20have%20any%20previous%20policy%20remnants%20getting%20in%20the%20way.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20changed%20the%20settings%20you%20suggested%20yesterday%20in%20the%20test%20policy%20and%20then%20deployed%20a%20new%20VM%20to%20test%20the%20policy.%26nbsp%3B%20Updates%20were%20installed%20yesterday%20and%20now%20I%20am%20just%20watching%20to%20see%20if%20I%20get%20any%20notifications%20before%20restarting.%26nbsp%3B%20The%20Start%20Menu%20Power%20indicates%20updates%20need%20a%20restart%20as%20does%20the%20Taskbar%20icon.%26nbsp%3B%20I%20haven't%20seen%20a%20toast%20notification%20yet%20though.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20seen%20references%20to%20the%20registry%20key%20%22restartnotificationsallowed2%22%20in%20HKLM%5CMicrosoft%5CWindowsUpdate%5CUX%5CSettings%20and%20setting%20the%20value%20to%201.%26nbsp%3B%20I%20have%20tried%20that%20and%20yet%20the%20option%20in%20Settings%26gt%3BUpdate%20%26amp%3B%20Security%20%26gt%3B%20Windows%20Update%20%26gt%3B%20Advanced%20options%20for%20%22Show%20a%20notification%20when%20your%20PC%20requires%20a%20restart%20to%20finish%20updating%22%26nbsp%3B%20remains%20Off%20and%20is%20unchangeable%20as%20it%20says%20it%20is%20managed%20by%20my%20organization.%26nbsp%3B%20Should%20that%20registry%20key%20be%20set%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E-%20John%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2276462%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Update%20Baseline%20joins%20the%20Security%20Compliance%20Toolkit%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2276462%22%20slang%3D%22en-US%22%3E%3CP%3EI%20decided%20to%20set%20every%20setting%20under%20Windows%20Update%20to%20Not%20Configured%26nbsp%3B%3CEM%3Eexcept%3C%2FEM%3E%20the%20once%20I%20know%20I%20want%20configured%20and%20that%20got%20notification%20working%20as%20soon%20as%20the%20VM%20hit%20the%20WSUS%20server.%26nbsp%3B%20The%20one%20on%20the%20left%20is%20the%20new%20VM%20with%20the%20stripped%20back%20policy%2C%20and%20the%20one%20on%20the%20right%20is%20the%20one%20with%20the%20two%20settings%20changed%20back%20to%20Not%20Configured%20as%20you%20suggested%20yesterday.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22screen1.png%22%20style%3D%22width%3A%20373px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F273430i8B8505132E2F9990%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22screen1.png%22%20alt%3D%22screen1.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20policy%20for%20the%20one%20that%20hasn't%20received%20any%20notifications%20yet%20has%20these%20settings%2C%20which%20is%20a%20slightly%20modified%20version%20of%20the%20baseline%3A%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22screen2.png%22%20style%3D%22width%3A%20843px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F273432i24BD9E7F284044D8%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22screen2.png%22%20alt%3D%22Update%20Baseline%20with%20Modifications%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EUpdate%20Baseline%20with%20Modifications%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20one%20that%20was%20instantly%20notified%20has%20these%20settings%3A%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22screen3.png%22%20style%3D%22width%3A%20841px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F273433iA95F2DDDE79E4D1D%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22screen3.png%22%20alt%3D%22Stripped%20back%20Policy%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EStripped%20back%20Policy%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%20in%20my%20testing%20it%20seems%20that%20even%20though%20the%20baseline%20is%20enforcing%20the%20defaults%2C%20something%20in%20it%20is%20preventing%20notifications.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Version history
Last update:
‎Jan 26 2021 09:07 AM
Updated by: